Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Correctly Parse JSON that has has been formatted with the JSON Array Vulnerability Protection #59

Open
mdedetrich opened this issue Dec 3, 2014 · 0 comments · May be fixed by #60
Open

Comments

@mdedetrich
Copy link

http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx
tornadoweb/tornado#1009 (comment)
https://docs.angularjs.org/api/ng/service/$http

Long story short, due to a JSON security vulnerability, sites can output their json in the form of

{"d": ["Philha", "my-confession-to-crimes", 7423.42]}

Which represents the original json value of

["Philha", "my-confession-to-crimes", 7423.42]

Alternately (and my webserver does this), it can prelude the original JSON with the following string

)]}',\n

So the previous example would look like

)]}',
["Philha", "my-confession-to-crimes", 7423.42]

The require.js JSON plugin should account for this, currently it fails parsing with the following error message

SyntaxError: JSON Parse error: Unexpected token ')'

(when using the prelude version)

@mdedetrich mdedetrich changed the title Parse JSON that has has been formatted with the Json Array Vulnerability Protection Correctly Parse JSON that has has been formatted with the JSON Array Vulnerability Protection Dec 3, 2014
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant